Business Continuity Plan template

The purpose of operational level business continuity plans is to help continue to deliver prioritized activities at acceptable predefined levels following a disruptive incident, until normal operations have been restored.

Operational level business continuity plans can include a variety of information, to some extent it is dependent on the type of activities you do and what information is of value to you during a disruptive incident. For the business continuity plan template on The Continuity Advisor, I’ve included the following core parts:

• Contacts to enable methods of contact between teams, internal and external stakeholders.
• Purpose and scope of the plan.
• Prioritized activities with timescales for recovery.
• Methods for incident management and to integrate with tactical level organization plans.
• Roles and responsibilities so staff know who is doing what to implement the business continuity solution, oversee the response and update relevant stakeholders.
• Business continuity solutions for prioritized activities that resume the activity within the recovery time objective.
• Procedures to guide any complex actions require to implement a business continuity solution.
• Lessons learned to support continuous improvement once the incident has been resolved.
• I also include any additional information which may be useful in the appendices. This might include lists of equipment, allocation of resources, references to Service Level Agreements or other information.

Ultimately though, it depends on what the business continuity plan is designed to achieve and the information has to be of benefit to you during a disruptive incident.

ISO 22301 informs that business continuity plans provide the information needed for teams to respond to disruptive incidents and resume activities within the scope of the business continuity programme. Disaster recovery plans are typically used in the context of ICT for recovering ICT systems and infrastructure, although I have also seen disaster recovery plans designed to recover damaged hard copy documents and buildings as well.

ICT disaster recovery plans include the information needed to recover ICT capabilities following a disruptive incident. Hard copy document recovery plans might include the information needed to recover damaged hard copy documents or archived items (for example from water damage) using a specialist third party. Building disaster recovery plans might include the details of the use of specialist third parties for repairing damage and recovering an area of a building.

There are many ways to go about writing a business continuity plan, but my personal favorite is to organize a business continuity plan workshop for perhaps 1.5 hours and get a handful of knowledgeable staff together to work collaboratively on the document. I always think it’s hard for one person to complete the whole plan, but collaboration always makes this so much easier – plus you get a variety of knowledge and expertise in the room. In the past, I’ve booked two meetings (rather than trying to complete the plan in one go) and have worked collaboratively with a group to complete half of the plan in one meeting and then the second half in the following meeting. Any minor tasks such as contact details can be added outside of the workshop, but workshops are great for discussing roles and responsibilities, documenting business continuity solutions and agreeing what information is valuable to include in the appendices.

My personal thoughts for determining how often to test and exercise a business continuity plan is to look at the purpose of the test and exercise. For example, I see business continuity exercises as being extremely valuable for rehearsing staff with their roles and responsibilities and with validating the business continuity solutions. Trained staff and validated solutions contribute to the successful implementation of the business continuity plan. Therefore, if you have staff changes involving those needed to implement the business continuity plan or there is a change with your resources or the business continuity solution itself, then I would schedule an exercise. You definitely don’t want to leave it too long between exercises as even trained staff may become unfamiliar with how to implement the plan again. You also want to make sure that all parts of the plan are validated through tests and exercises so you may have a series of exercises scheduled throughout the year that validate specific parts of the business continuity plan.